-
A single attacker published four malicious npm packages under the username “deadcode09284814,” and they are still available for download.
-
One package unleashes the Phantom Bot DDoS tool, while three others steal sensitive data like SSH keys and crypto wallets.
-
The attacker cloned open source “Shai-Hulud” worm code almost unchanged, proving how easy supply chain attacks have become.
Cybersecurity analysts found four new npm packages with harmful malware. These packages consist of an assortment of harmful code, including an infostealer and a DDoS botnet known as Phantom Bot.
All four packages remain available for download on npm right now. A single user named “deadcode09284814” published each one.
One Attacker, Four Different Payloads
Cybersecurity researchers at OX Security spotted these bad packages. The same npm user, “deadcode09284814,” published all of them. But here’s the clever twist. Each of these packages performs a different function.
‘Axois-utils,’ which is a typo of axios) has recorded 963 downloads. This one delivers a Golang DDoS botnet called Phantom Bot. It can flood any target website using HTTP, TCP, or UDP protocols. The package also makes sure it stays on your machine. On Windows, it adds itself to the Startup folder. On Linux, it creates a scheduled task. Nasty persistence.
The other three packages focus on stealing your data. ‘chalk-tempalte’ (another typo) saw 825 downloads. It’s a direct clone of the Shai-Hulud worm that TeamPCP leaked last week. The attacker barely changed anything. They just plugged in their own command-and-control (C2) server and private key. That server lives at 87e0bbc636999b.lhr[.]life. Stolen credentials go there first.
But it gets worse. The malware also uses a stolen GitHub token to export your data to a new public repo. That repo’s description? “A Mini Sha1-Hulud has Appeared.” So the attacker isn’t even hiding their tracks.
The last two packages, ‘@deadcode09284814/axios-util’ (284 downloads) and “color-style-utils” (934 downloads), are more straightforward. They siphon SSH keys, environment variables, cloud credentials, system info, IP addresses, and cryptocurrency wallet data. Those secrets go to 80.200.28[.]28:2222 and edcf8b03c84634.lhr[.]life.
Why this Open-Source Worm Changes Everything
Here’s what worries me most. TeamPCP leaked the Shai-Hulud source code just last week. Within days, an attacker grabbed it, changed almost nothing, and uploaded it to npm.
Moshe Siman Tov Bustan from OX Security says this probably came from a “supply chain attack competition” posted on BreachForums. So now, criminals are literally competing to see who can spread malware faster using open-source code.
Nation-state actors are also active in this space. North Korean hackers have been identified planting malicious packages across npm, PyPI, and other open-source repositories, showing that both cybercriminals and state-sponsored groups see value in supply chain attacks.
This makes attacks so much easier. A wannabe hacker doesn’t need to write anything from scratch. They just copy, paste, and point to their own C2 server.
And remember, a single actor here used multiple techniques. One package does DDoS. Another steals credentials. A third exports your data to GitHub. That’s versatility.
What You Should Do Right Now
If you downloaded any of these four packages, take action immediately.
First, uninstall the package. Don’t just leave it.
Second, hunt down malicious configs in your IDEs and coding agents like Claude Code. Delete them.
Third, rotate all your secrets. That means API tokens, SSH keys, cloud credentials, everything.
Fourth, search GitHub for any public repository with the description “A Mini Sha1-Hulud has Appeared.” Chances that your stolen data might be in one of these repositories. Also, make a move to block your network access to all those suspicious domains mentioned.
OX Security warns this is just the first phase. More supply chain attacks are coming. The open source nature of Shai-Hulud can potentially lead to an increase in typo-squatting. So remember to always check the spelling of an npm package name before you actually install it.
